Operational Resilience Audit

Challenges Faced by Auditors when Conducting an Operational Resilience Audit

Scope Definition

The challenges to defining the scope for an operational resilience audit primarily revolve around the complexities arising from the interconnected nature of an organisation's operations and the need for a comprehensive understanding of its inner workings. Interconnectedness of Business Functions Many modern organisations have intricate webs of interconnected processes and systems. Pinpointing the boundaries of the audit scope becomes challenging because disruptions in one area can ripple across others. This interconnectedness makes it difficult to isolate individual components for assessment. Dependency Identification Understanding the dependencies between various critical business services, especially the breakdown in business functions, systems, and third-party entities, is crucial. However, these dependencies might only sometimes be explicit or easily discernible. Some critical dependencies might be hidden or overlooked, potentially leaving vulnerabilities to be addressed. Depth of Understanding A deep understanding of the organisation's operations, especially in larger or more complex enterprises, demands substantial time and resources. Without a comprehensive grasp of how different functions interrelate and support each other, auditors might miss critical components or fail to evaluate their significance accurately. Dynamic Nature of Operations Businesses are in a constant state of flux. New technologies, process changes, or market adaptations might alter the operational landscape. Keeping up with these changes and adjusting the audit scope is challenging and requires continuous monitoring and updates. Subjectivity in Prioritisation Identifying and prioritising critical processes or functions can be subjective. Different organisational stakeholders may have varying opinions on what is critical or less critical. Balancing these perspectives to create an objective and practical scope can be challenging. Summarising the execution of Scope Definition ... To tackle these challenges, auditors must collaborate closely with stakeholders across departments, leverage data analytics and technology to map dependencies, conduct extensive interviews and workshops, and continuously reassess the scope throughout the audit process. Flexibility and adaptability are essential to refine the audit scope to align with the organisation's evolving operational landscape. Summing Up ... Addressing these challenges often requires a multidisciplinary approach involving collaboration across various departments, access to updated information, leveraging technological solutions for data analysis, and continuous adaptation to emerging threats. Flexibility and agility in audit methodologies are crucial to assess and enhance an organisation's operational resilience effectively. Types of Challenges Faced by OR Auditor and Reviewer     Find out more about Blended Learning ORA-5000 [ORA-5] & ORA-300 [ORA-3]

	Please feel free to send us a note if you have any of these questions.

ORA-5000 Operational Resilience Audit Expert  2024 Course Schedule

Click any of the "Run #" icons in each table below to learn more about the course schedule you are interested in.  The breakdown of each run by Modules 1 to 4 is also illustrated.

The schedule is appended below. 

 

Year & Run	[BL-ORA-5] 2024 Run 2
Quarter	Two (May to Jun 24)
Start Date	8 May 24	24 May 24	7 Jun 24	21 Jun 24
End Date	15 May 24	31 May 24	14 Jun 24	28 Jun 24

NOTE: Run 2 class starting at 2 PM GMT+8

 

Year & Run	[BL-ORA-5] 2024 Run 2A
Quarter	Two (Jun to Jul 24)
Start Date	4 Jun 24	18 Jun 24	4 Jul 24	18 Jul 24
End Date	11 Jun 24	25 Jun 24	11 Jul 24	25 Jul 24

NOTE: Run 2A class starting at 9 PM GMT+8 Click FAQ icon to check the timing for your region.  Read, "I noticed that the course is held at Asian time. Is there any time for me as I reside outside the Asia Pacific Region?"

 

Year & Run	[BL-ORA-5] 2024 Run 3
Quarter	Three (Jul to Sep 24)
Start Date	31 Jul 24	14 Aug 24	26 Aug 24	9 Sep 24
End Date	13 Aug 24	21 Aug 24	2 Sep 24	17 Sep 24

NOTE: Run 3 class starting at 2 PM GMT+8

Note that 16 Sep 24 is a Public Holiday in Malaysia (Prophet Muhammad's birthday). The class will resume on the following day, i.e. 17 Sep 24

 

Year & Run	[BL-ORA-5] 2024 Run 3A
Quarter	Three (Sep to Oct 24)
Start Date	6 Sep 24	27 Sep 24	10 Oct 24	24 Oct 24
End Date	19 Sep 24	4 Oct 24	17 Oct 24	30 Oct 24

NOTE: Run 3A class starting at 9 PM GMT+8

 

Year & Run	[BL-ORA-5] 2024 Run 4
Quarter	Four (Oct to Dec 24)
Start Date	27 Oct 24	6 Nov 24	21 Nov 24	5 Dec 24
End Date	10 Nov 24	13 Nov 24	28 Nov 24	12 Dec 24

NOTE: Run 4 class starting at 2 PM GMT+8

 

Year & Run	[BL-ORA-5] 2024 Run 4A
Quarter	Four (Oct to Dec 24)
Start Date	27 Oct 24	11 Nov 24	27 Nov 24	11 Dec 24
End Date	10 Nov 24	18 Nov 24	4 Dec 24	18 Dec 24

NOTE: Run 4A class starting at 9 PM GMT+8

 

+ For ORCP/ ORAS/ ORAE Qualifying Examination:

The program manager will advise on the next step once you enrol in the course.

 

More Information About Blended Learning Operational Resilience Audit (ORA) Courses

BCM Institute offers two levels of OR auditing courses: ORA-3 Blended Learning ORA-300 Operational Resilience Audit Specialist and the ORA-5 Blended Learning ORA-5000 Operational Resilience Audit Expert.

	Please feel free to send us a note if you have any questions.

Guidelines on Operational Resilience by the Hong Kong Monetary Authority

Operational resilience is critical for financial institutions in ensuring uninterrupted services and maintaining the financial system's stability. The Hong Kong Monetary Authority (HKMA) has issued guidelines to provide a comprehensive framework for financial institutions in Hong Kong to enhance their operational resilience. 

Referring to the actual "Supervisory Policy" or "SPM OR-2" is important, which sets out HKMA’s approach and supervisory expectations on operational resilience.  Refer to the guideline by clicking on the HKMA webpage.

Objective

This blog aims to provide participants attending the Operational Resilience Implementer and Expert Implementer course with global or regional responsibilities to understand the:

• The general principles outlined by the Hong Kong Monetary Authority (HKMA) that institutions must consider when developing their operational resilience framework.  
• Guidelines and be able to compare with those issued by other central banks from other regional justifications.

Definition of Operational Resilience

Operational resilience refers to a financial institution's ability to consistently deliver critical operations and services, even during disruptions or unexpected events.

It encompasses the organisation's ability to prevent, adapt, respond, and recover from operational disruptions to maintain continuity and protect the interests of customers and stakeholders.

Operational Resilience Framework

Financial institutions are expected to establish an operational resilience framework that integrates people, processes, and technology to enhance their overall resilience.

The framework should include the following components:

Governance and Accountability

The board and senior management should demonstrate clear responsibility and accountability for operational resilience. They should oversee and approve the institution's operational resilience strategy, policies, and risk tolerance levels.

Risk Identification and Assessment

Financial institutions should identify and assess the potential risks and vulnerabilities associated with their critical business services, processes, and systems. This includes conducting regular impact assessments and scenario analyses to understand the potential consequences of operational disruptions.

Business Impact Tolerance

Institutions should define their business impact tolerance, reflecting the maximum tolerable disruption to critical services, processes, and systems. This determination should consider the institution's risk appetite, customer expectations, and market conditions.

Planning and Strategy

Institutions should develop robust and comprehensive plans to address operational disruptions effectively. Considering various scenarios and potential impacts, these plans should cover incident response, crisis management, and business continuity.

Testing and Validation

Regular testing and validation exercises should be conducted to evaluate the effectiveness of the operational resilience framework. Institutions should identify gaps, areas for improvement and implement corrective actions based on the test results.

Reporting and Communication

Institutions should establish clear lines of communication and report for operational disruptions. This includes promptly reporting incidents to the HKMA and maintaining effective communication with customers, stakeholders, and regulatory authorities.

Role of the Board and Senior Management

The guidelines emphasise the board's and senior management's crucial role in ensuring operational resilience. They should demonstrate strong leadership, establish a culture of resilience, and promote effective governance practices within the organisation. Key responsibilities include:

Setting the Operational Resilience Strategy

The board and senior management should define the institution's strategic objectives regarding operational resilience, aligning them with the overall business strategy.

Risk Management Oversight

They should oversee the identification, assessment, and management of operational risks, ensuring appropriate risk controls and mitigation measures are in place.

Resource Allocation

The board and senior management should allocate sufficient resources, including budget, staff, and technology, to support the implementation and maintenance of the operational resilience framework.

Monitoring and Reporting

They should establish mechanisms to monitor the effectiveness of the operational resilience framework and receive regular reports on key resilience indicators and performance metrics.

Determining Operational Resilience Parameters

Financial institutions should establish operational resilience parameters to define the levels of resilience required for their critical business services, processes, and systems. These parameters should be determined based on factors such as:

Criticality and Impact

Institutions should consider the criticality and potential impact of a disruption on customers, financial stability, and the broader economy.

Recovery Time Objectives (RTOs)

RTOs specify the maximum tolerable downtime for critical services, processes, and systems, guiding the planning and recovery strategies.

Recovery Point Objectives (RPOs)

RPOs define the maximum acceptable data loss in case of disruptions, guiding data backup and recovery measures.

Dependencies and Interconnections

Institutions should consider the dependencies and interconnections between their internal and external systems and third-party service providers to ensure comprehensive resilience.

Mapping Interconnections and Interdependencies

Financial institutions must map the interconnections and interdependencies that underlie their critical operations. This includes identifying the key business services, processes, systems, and resources, both internal and external, on which their operations rely. 

By mapping these interconnections, institutions can understand the potential impact and dependencies in the event of disruptions. This knowledge enables them to identify vulnerabilities and implement appropriate measures to enhance resilience.

Preparing for and Managing Risks to Critical Operations Delivery

Financial institutions should proactively prepare for and manage risks that could affect the delivery of critical operations. 

This involves robust risk assessments to identify potential threats, vulnerabilities, and impacts. Institutions must establish risk management frameworks that identify, measure, monitor, and mitigate risks. These frameworks should align with the institution's risk appetite and regulatory requirements. By effectively managing risks, institutions can enhance their ability to withstand disruptions and ensure the continuity of critical operations.

Testing Ability to Deliver Critical Operations under Severe but Plausible Scenarios

Financial institutions must test their ability to deliver critical operations under severe yet plausible scenarios. 

This includes scenario-based exercises to simulate disruptions and assess the institution's response and recovery capabilities. Testing should cover various aspects, such as incident response, crisis management, communication, and business continuity. Regular testing helps identify weaknesses, refine response plans, and enhance the institution's overall operational resilience.

Responding to and Recovering from Incidents

Financial institutions should establish robust response and recovery plans to address operational incidents effectively. 

This involves defining clear roles, responsibilities, and escalation procedures to ensure a coordinated response. Institutions should also establish mechanisms for timely communication with stakeholders, including customers, regulators, and relevant authorities.

By promptly responding to incidents and implementing effective recovery measures, institutions can minimise the impact on critical operations and expedite the restoration of services.

Implementation of Operational Resilience Requirements

Financial institutions are expected to implement operational resilience requirements throughout their organisation. 

This includes embedding a culture of resilience, providing appropriate training and awareness programs for employees, and integrating operational resilience considerations into decision-making processes. 

Institutions should allocate sufficient resources to support the implementation of operational resilience requirements and establish mechanisms for monitoring, reporting, and ongoing improvement.

Conclusion

The HKMA's guidelines on operational resilience provide financial institutions in Hong Kong with a comprehensive framework to strengthen their operational resilience. 

By considering the general principles outlined in these guidelines, institutions can develop robust operational resilience frameworks that ensure the continuity of critical operations and protect the interests of customers and stakeholders.

Implementing these guidelines is essential for maintaining the financial system's stability and safeguarding the reputation of financial institutions in Hong Kong.

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.

Analyse the Gap 

This section is the "Plan" phase of the Operational Resilience Planning Methodology.  It is the second stage of the Plan phase: Analyse Gap.

Audit Checklist for Analysing the Gap for Incident and Crisis Management

Do note that some steps may overlap or appear similar in the other stages of the OR planning phases.  If this occurs, the questionnaires and checklists must be contextualised to the topic under review.

Questionnaires and Checklist "Plan" Phase	Assess Capability and Maturity	Analyse Gap	Develop Strategy Roadmap	Confirm Risk Appetite	Develop and Embed Governance

Find out more about Blended Learning ORA-5000 [BL-ORA-5] & ORA-300 [BL-ORA-3]

	Please feel free to send us a note if you have any of these questions.

Analyse the Gap: Concentration Risk

This section is the "Plan" phase of the Operational Resilience Planning Methodology.  It is the second stage of the Plan phase: Analyse Gap.

These questions, checklists, and details should help assess the concentration risk and operational resilience measures related to primary-secondary site operation, critical business functions segregation, split team and backup team arrangements cross-training cross-border support, and alternative service provider considerations and requirements of the MAS BCM Policy.

Audit Checklist for Analysing the Gap: Concentration Risk

Questionnaires and Checklist "Plan" Phase	Assess Capability and Maturity	Analyse Gap	Develop Strategy Roadmap	Confirm Risk Appetite	Develop and Embed Governance

Find out more about Blended Learning ORA-5000 [BL-ORA-5] & ORA-300 [BL-ORA-3]

	Please feel free to send us a note if you have any of these questions.